{"id":"CVE-2026-91259","kind":"vulnerability","aliases":["CVE-2026-91259"],"related":[],"title":"Oracle Identity Manager: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Identity Manager's OIM Legacy UI component has a flaw in 12.2.1.4.0 and 14.1.2.1.0. An attacker with a low-privilege account and network access over HTTP can take over OIM, with no user interaction (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update. No exploitation or public PoC is known.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-identity-manager","other","self-hosted","vendor"],"not_affected_if":["managed-hosting","versions-outside-affected-list"],"how_to_check":"Check whether you run Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 (for example with OPatch lsinventory in the OIM Oracle home). Then check whether the OIM Legacy UI is reachable over HTTP from untrusted networks or by any low-privilege account. Oracle's public text does not say whether the Legacy UI is enabled by default, so this is unknown.","fix":"Apply the October 2026 Oracle Critical Patch Update for Oracle Identity Manager from My Oracle Support. The specific patch number is not public (see the Fusion Middleware patch availability document linked from the CPU). Until then, restrict network access to the OIM Legacy UI to trusted admin networks.","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:13+00:00","updated_at":"2026-10-23T23:58:31+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:34:13Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for your OIM version; the patch number is unknown from the sources.","reach":"network","title":"Oracle Identity Manager: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle Identity Manager's OIM Legacy UI has a flaw that lets an attacker with a low-privilege account over the network take over the product. The sources say the attack succeeds over HTTP with no user interaction and gives full confidentiality, integrity and availability impact.","category":"other","who_cares":["oracle-identity-manager","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the identity manager, reading and changing all its data","analyst_note":"Find the Oracle Critical Patch Update advisory listing the patch number for OIM 12.2.1.4.0 and 14.1.2.1.0; check whether the OIM Legacy UI is enabled by default.","how_to_check":"Check the installed version: 12.2.1.4.0 and 14.1.2.1.0 are listed as affected. Confirm whether the OIM Legacy UI is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["managed-hosting","versions-outside-affected-list"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000557,"input_tokens":3090,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the April 2026 cycle (or the CVE entry at nvd.nist.gov) for the patched versions and whether the OIM Legacy UI must be enabled.","search":"'-2026':14A,17A '-91259':15A,18A '/av':164C '12.2.1.4.0':47B,117C '14.1.2.1.0':49B,119C '2026':85B '3.1':72B,151C,163C '8.8':73B,154C 'access':60B,129C 'account':57B 'affect':115C 'allow':123C 'attack':8A,51B,126C,138C 'av':74B 'avail':158C 'base':152C 'compon':42B,107C 'compromis':133C 'confidenti':155C 'critic':86B 'cve':13A,16A 'cvss':71B,150C,160C,162C 'easili':120C 'exploit':90B,121C 'fix':80B 'flaw':45B 'fusion':24B,105C 'h':172C 'h/a':171C 'h/i':170C 'host':33B 'http':7A,62B,131C 'ident':2A,28B,36B,100C,135C,148C 'identity':20A 'impact':159C 'integr':156C 'interact':70B 'known':95B 'l/pr':76B,166C 'l/ui':77B,167C 'legaci':40B,109C 'low':5A,55B,124C 'low-privileg':4A,54B 'manag':3A,29B,37B,101C,136C,149C 'manager':21A 'middlewar':25B,106C 'n':78B 'n/ac':75B,165C 'n/s':168C 'network':59B,128C 'octob':84B 'oim':39B,66B,108C 'oracl':1A,23B,27B,35B,79B,99C,104C,134C,147C 'oracle':19A 'oracle-fusion-middlewar':22B 'oracle-identity-manag':26B 'patch':87B 'poc':93B 'privileg':6A,56B,125C 'product':102C 'public':92B 'result':143C 'score':153C 'self':32B 'self-host':31B 'server':12A 'success':137C 'support':111C 'take':10A,64B 'takeov':145C 'u/c':169C 'ui':41B,110C 'updat':88B 'user':69B 'vector':161C 'vendor':34B 'version':112C 'via':130C 'vulner':96C,122C,141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91259","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91259:557","url":null,"severity":null,"published_at":"2026-10-23T23:58:31+00:00","modified_at":"2026-10-23T23:58:31+00:00","first_seen_at":"2026-10-23T23:58:31+00:00","fetched_at":"2026-10-23T23:58:31+00:00","note":"Fixed in Oracle's October 2026 CPU (released 2026-10-20), not April as the triage note guessed. The CPU lists OIM 12.2.1.4.0 and 14.1.2.1.0 under Fusion Middleware. CVE.org and Armis confirm CVSS 8.8 and the OIM Legacy UI component. No patch number or fixed version in public pages (it is behind My Oracle Support). No exploitation reported (not in KEV per Armis). I found no PoC. I did not search X or HN because the product is obscure and the id is new."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2283,"url":"https://cve.armis.com/CVE-2026-91259","title":"Armis: CVE-2026-91259","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2286,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91259","title":"CVE Record: CVE-2026-91259","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}